The federal privacy commissioner, alerted by a reporter, is also looking into the incident.
…the bank learned the faxes were being sent to the wrong person on Sept. 29, when Soda contacted the bank to request they be stopped. Soda said that she had been receiving misdirected faxes for about 18 months…

The Toronto Star
March 8, 2006

Tangled tale another mess for CIBC
Confidential papers sent to wrong firm. Bank in court to get documents returned.
Rick Westhead

CIBC, already the subject of several embarrassing privacy breaches, is at the centre of another fax mishap, this one a bizarre tale involving the brother of one-time hockey enforcer Marty McSorley.

Gerry McSorley — the former NHLer's sibling and owner of Flite Hockey, which makes skates and other equipment — says the bank told him several months ago it had inadvertently been faxing confidential information intended for him to someone else, even though he had told CIBC about his new fax number after he moved the business.

The Mississauga woman who received the wayward faxes, Christine Soda, is now the subject of legal action launched by CIBC and Flite Hockey, which claim she refused to return the documents after the bank discovered its mistake. The federal privacy commissioner, alerted by a reporter, is also looking into the incident.

Soda said she initially would not return the documents because her husband, Liugi Soda, needed them for a wrongful dismissal suit against his former employer — who in an unlikely twist happens to be Soda's mother.

Luigi Soda was accused of running another business after he took the faxes to work.

Soda said her understanding is that the documents have now been turned over.

Last night, Soda said the bank's legal action was "a pain in the neck."

"At first it was bad because I was wasting paper and toner and getting these faxes that I couldn't stop because there was no cover sheet with a contact number," she said. "Now, I get smacked with a lawsuit over it."

McSorley said in an interview that the faxes she received contained instructions to wire money to a supplier in China that manufactured his company's products.

CIBC, which McSorley said has agreed to pay all of his legal costs related to acquiring the faxes, wouldn't comment, saying the case is before the courts. It has filed a notice of application in Ontario Superior Court asking a judge to order the faxes returned.

In court documents, CIBC said that from March 8, 2004, to Sept. 23, 2005, 13 faxes relating to wire transfers from Flite Hockey to its suppliers in China were inadvertently sent to Soda.

"The CIBC has requested the return of the faxes on numerous occasions and to date Christine Soda has refused or failed to do so," the filing states.

No allegations against Soda have been proved in court.

In an affidavit sworn Feb. 10, CIBC's Joanne MacLeod, an employee in the bank's customer care division, said the bank learned the faxes were being sent to the wrong person on Sept. 29, when Soda contacted the bank to request they be stopped.

Soda said that she had been receiving misdirected faxes for about 18 months, MacLeod's affidavit said.

"CIBC was advised by Christine Soda that her husband had taken the misdirected faxes to his work and that when his employer noticed these faxes the employer assumed that Mr. Soda was engaged in inappropriate outside activities and fired him," MacLeod said.

The incident is the latest in a string of recent public relations setbacks for Canada's fifth-largest bank. In 2004, CIBC admitted that for three years, it had sent confidential client RSP information to the owner of a West Virginia scrapyard, after being alerted repeatedly by the yard's owner to the mistake.

CIBC took the unusual step of announcing it would suspend all faxes from its network of 1,200 branches, and instead would use courier services to transmit customer data while it considered alternative technologies.

Just weeks after that bombshell, the Toronto-based bank said it had also been sending faxes that contained customer names, home addresses, social insurance numbers and account numbers to a Montreal businessman.

In a bid to defuse the controversy, then-CIBC chief executive John Hunkin, in a newspaper ad, pledged to introduce "new ways to further protect the handling of customer information … Our priority is to keep the information you entrust to our care safe and secure."

Hunkin subsequently met with federal privacy commissioner Jennifer Stoddart and gave an assurance that the bank had made "a major investment" in privacy practices. At the time, CIBC also said it would adopt all of the recommendations made by Stoddart's office on faxes.

"To be honest, when CIBC called me to tell me they'd been sending my information to the wrong person, the first thing I thought of was that scrapyard," McSorley said. "It's just a really unfortunate situation."

"This latest development is going to be reverberating through the offices of all the banks," said Alan Middleton, a marketing professor at the Schulich School of Business at York University. "It's not good news for anybody. Everybody's going to be looking again at what systems they have in place."